Repository navigation
fix(deps): raise litellm floor to 1.84.0 and exclude hijacked 1.107.0 - #71
Merged
Merged
Conversation
litellm 1.107.0 on PyPI shipped backdoored wheels with a .pth startup hook that steals credentials on every Python start, even without importing litellm. Our previous range (>=1.79.1) still admitted it. - Raise the floor to 1.84.0 for the SSRF fix in 1.83.7 (GHSA-xqmj-j6mv-4862) and CVE-2026-49468 fixed in 1.84.0. This also skips the earlier compromised lines 1.80.16 / 1.82.3 / 1.82.7 / 1.82.8. - Explicitly exclude 1.107.0 (BerriAI/litellm#47826). Refs: https://research.jfrog.com/post/litellm-hijacked-again/ Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Recent ruff releases started reporting PLR0917 under the "PL" selection, which breaks CI on existing public APIs (up to 14 positional args). PLR0913 (too-many-arguments) is already ignored, so ignore PLR0917 for consistency. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Recent ruff releases also format Python code blocks embedded in Markdown, so `ruff format --check .` in CI started failing on 59 README/docs files. Docs don't need code formatting checks; exclude *.md from formatting only (lint is unaffected). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI started failing after the latest dependency releases were resolved:
- redis-py 8 stores pool-internal entries (e.g. himport_registry) in
connection_pool.connection_kwargs, which Redis.__init__ rejects.
GraphStore._ensure_binary_client now passes only constructor
parameters when recreating a binary-safe client.
- Starlette 1.x removed the legacy TemplateResponse(name, {"request": ...})
signature. Use TemplateResponse(request, name, context) instead
(supported since Starlette 0.29).
- redis-py 8 sets socket_timeout=5 by default; update the round-trip test
to expect the original client's socket_timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Updates the litellm requirement from
litellm>=1.79.1,!=1.82.7,!=1.82.8tolitellm>=1.84.0,!=1.107.0.Why
litellm 1.107.0 on PyPI was hijacked (JFrog write-up, BerriAI/litellm#47826). All platform wheels drop a
.pthstartup hook andsitecustomize.pyinto site-packages. On every Python start (pip included, noimport litellmneeded) they collect env vars, SSH/cloud/Kubernetes credentials, AI-assistant tokens, and send them to an attacker host.Our previous range
>=1.79.1still allowed 1.107.0, so a plainpip install graflowduring the window could have resolved to the bad wheel.While here, the floor is raised to 1.84.0:
!=1.82.7,!=1.82.8exclusions are no longer needed.Impact on existing installs
uv.lockisn't tracked in this repo, so only the declared specifier changes.Anyone who installed graflow with pip and got litellm 1.107.0 should treat the host as compromised and rotate credentials (see the JFrog post for IOCs).
Testing
uv pip compile pyproject.toml: resolves, picking litellm 1.105.1.🤖 Generated with Claude Code